AI-generated malware targets hotel guests in cyberattacks
Security firm Kaspersky reported that RevengeHotels, a threat group active since 2015, conducted cyberattacks between June and August 2025 targeting hotel guests to steal payment data. The group increasingly used AI-generated malware code to make phishing attacks more sophisticated and harder to detect, primarily targeting hotels in Brazil but also reported in other countries including African nations.
What happened
Kaspersky's Global Research and Analysis Team identified cyberattacks between June and August 2025 by threat group RevengeHotels, which targets hotels to obtain financial information from visitors.
The threat group sends phishing emails to hotel staff disguised as reservation requests or job applications. Once a hotel employee interacts with these emails, malware called VenomRAT is installed on the hotel's systems, giving attackers access to guests' payment data and other sensitive information.
A large number of the malicious programs utilized in these attacks had code that was probably created using artificial intelligence, making them more complex and harder to identify.
Reported impact
Hotels in Brazil have been the main target to date, but such cyberattacks have also been reported in other countries around the globe, including Africa.
For hotel guests, this translates into higher risks of card and personal data theft, even when they trust well-known hotels.
Index analysis
Cybercriminals are increasingly using AI to create new tools and make their attacks more effective, making familiar schemes like phishing emails harder to spot for common users.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.